urlscan.io logo urlscan.io
SecurityTrails logo

www.confirmation-gov.co.uk-complete.form.jsp.transferet.co.in Open in urlscan Pro
173.249.58.216  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
URL: https://www.confirmation-gov.co.uk-complete.form.jsp.transferet.co.in/form.html
Submission: On March 23 via automatic, source openphish
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 5 IPs in 1 countries across 3 domains to perform 14 HTTP transactions. The main IP is 173.249.58.216, located in Nuremberg, Germany and belongs to CONTABO, DE. The main domain is www.confirmation-gov.co.uk-complete.form.jsp.transferet.co.in.
TLS certificate: Issued by cPanel, Inc. Certification Authority on March 22nd 2021. Valid for: 3 months.
This is the only time www.confirmation-gov.co.uk-complete.form.jsp.transferet.co.in was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: UK Government (Government)

Domain & IP information

IP Address AS Autonomous System
1 173.249.58.216 51167 (CONTABO)
10 23.79.133.77 16625 (AKAMAI-AS)
1 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
14 5
Domain Requested by
10 www.tax.service.gov.uk www.confirmation-gov.co.uk-complete.form.jsp.transferet.co.in
www.tax.service.gov.uk
3 www.google-analytics.com www.confirmation-gov.co.uk-complete.form.jsp.transferet.co.in
www.google-analytics.com
1 www.confirmation-gov.co.uk-complete.form.jsp.transferet.co.in
14 3

This site contains links to these domains. Also see Links.

Domain
www.gov.uk
www.nationalarchives.gov.uk
Subject Issuer Validity Valid
confirmation-gov.co.uk-complete.form.jsp.transferet.co.in
cPanel, Inc. Certification Authority		 2021-03-22 -
2021-06-20		 3 months crt.sh
online.hmrc.gov.uk
DigiCert SHA2 Extended Validation Server CA		 2020-12-22 -
2021-04-15		 4 months crt.sh
*.google-analytics.com
GTS CA 1O1		 2021-02-23 -
2021-05-18		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://www.confirmation-gov.co.uk-complete.form.jsp.transferet.co.in/form.html
Frame ID: 73D0D33C772C97482ABE9A55C5865FA5
Requests: 16 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i
Overall confidence: 100%
Detected patterns
  • script /([\d.]+)?\/modernizr(?:.([\d.]+))?.*\.js/i

Page Statistics

14
Requests

100 %
HTTPS

50 %
IPv6

3
Domains

3
Subdomains

5
IPs

1
Countries

549 kB
Transfer

995 kB
Size

5
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

14 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request form.html
www.confirmation-gov.co.uk-complete.form.jsp.transferet.co.in/ 		15 KB
15 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.confirmation-gov.co.uk-complete.form.jsp.transferet.co.in/form.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
173.249.58.216 Nuremberg, Germany, ASN51167 (CONTABO, DE),
Reverse DNS
vmi452360.mujocloud.com
Software
Apache /
Resource Hash
1f33d98da30c1071be048cc5eb7bc2367d5620f2bf141535deb4520b20fbd16e

Request headers

Host
www.confirmation-gov.co.uk-complete.form.jsp.transferet.co.in
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
none
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1
Sec-Fetch-Dest
document
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 23 Mar 2021 01:25:38 GMT
Server
Apache
Last-Modified
Mon, 22 Mar 2021 09:48:25 GMT
Accept-Ranges
bytes
Content-Length
15422
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Content-Type
text/html
govuk-template.css
www.tax.service.gov.uk/template/assets/stylesheets/ 		20 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.tax.service.gov.uk/template/assets/stylesheets/govuk-template.css
Requested by
Host: www.confirmation-gov.co.uk-complete.form.jsp.transferet.co.in
URL: https://www.confirmation-gov.co.uk-complete.form.jsp.transferet.co.in/form.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.79.133.77 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-79-133-77.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
b56c2a21817362aeb9546f6a99f114c1df75afcce86762413b285a94c128e6dd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.confirmation-gov.co.uk-complete.form.jsp.transferet.co.in/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000;
Content-Encoding
gzip
X-Content-Type-Options
nosniff
x-amz-request-id
VMPD47TFT5JQ0X4R
Connection
keep-alive
Content-Length
4366
x-amz-id-2
jKOCgri1kopJmhgbGg5T0AN5gFcix0lDAjoKUDkpzea/34fzMad6z0U7jf/UKPhH4BxvFo9QMWU=
Last-Modified
Wed, 17 Mar 2021 11:09:55 GMT
X-Frame-Options
DENY
Date
Tue, 23 Mar 2021 01:25:38 GMT
Vary
Accept-Encoding
Content-Type
text/css
X-XSS-Protection
1; mode=block
Cache-Control
max-age=1428
ETag
"8b1874e022c4792c580fa0e7f9105c3c"
X-Robots-Tag
noindex, nofollow
Expires
Tue, 23 Mar 2021 01:49:26 GMT
fonts.css
www.tax.service.gov.uk/template/assets/stylesheets/ 		267 KB
196 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.tax.service.gov.uk/template/assets/stylesheets/fonts.css
Requested by
Host: www.confirmation-gov.co.uk-complete.form.jsp.transferet.co.in
URL: https://www.confirmation-gov.co.uk-complete.form.jsp.transferet.co.in/form.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.79.133.77 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-79-133-77.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
6813a04aa7ebe09726eda5fdd9c4abf1c5f151335adf0ad90474a5fe316e87ed
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.confirmation-gov.co.uk-complete.form.jsp.transferet.co.in/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000;
Content-Encoding
gzip
X-Content-Type-Options
nosniff
x-amz-request-id
AAF68YVJYVY2RZQK
Connection
keep-alive
Content-Length
200197
x-amz-id-2
bM09rpqpQKfpHU8BGVkIicKOuUPG4ko/L8wXT1SnABKWHSMgqQs0VcN47kTbTnr4X7dxgNzCa3k=
Last-Modified
Wed, 17 Mar 2021 11:09:55 GMT
X-Frame-Options
DENY
Date
Tue, 23 Mar 2021 01:25:38 GMT
Vary
Accept-Encoding
Content-Type
text/css
X-XSS-Protection
1; mode=block
Cache-Control
max-age=1116
ETag
"acaaac228246dd0eb9d5c1d9046094f7"
X-Robots-Tag
noindex, nofollow
Expires
Tue, 23 Mar 2021 01:44:14 GMT
application.min.css
www.tax.service.gov.uk/assets/2.214.0/stylesheets/ 		178 KB
41 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.tax.service.gov.uk/assets/2.214.0/stylesheets/application.min.css
Requested by
Host: www.confirmation-gov.co.uk-complete.form.jsp.transferet.co.in
URL: https://www.confirmation-gov.co.uk-complete.form.jsp.transferet.co.in/form.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.79.133.77 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-79-133-77.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
0b233d90b035d9fe079ad669af0252c7f7ca28902368f99c74f98c27ff30375c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www.confirmation-gov.co.uk-complete.form.jsp.transferet.co.in/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000;
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Thu, 09 Mar 2017 20:06:12 GMT
x-amz-request-id
ZCD3WXZBQJNBM3AK
ETag
"fa841e88d5c3822d82f24b02567b7440"
X-Frame-Options
SAMEORIGIN
Content-Type
text/css
Cache-Control
public, max-age=31009914
Date
Tue, 23 Mar 2021 01:25:38 GMT
Connection
keep-alive
X-Robots-Tag
noindex, nofollow
Vary
Accept-Encoding
Content-Length
41100
x-amz-id-2
+UsK/qnvLHnVqaqMTNx0a4SnAM7JbTntlDEDKLwyFGI47lXepcvDiEIXSAT+rxT4OskDXEFuxl0=
modernizr.js
www.tax.service.gov.uk/assets/2.214.0/javascripts/vendor/ 		9 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.tax.service.gov.uk/assets/2.214.0/javascripts/vendor/modernizr.js
Requested by
Host: www.confirmation-gov.co.uk-complete.form.jsp.transferet.co.in
URL: https://www.confirmation-gov.co.uk-complete.form.jsp.transferet.co.in/form.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.79.133.77 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-79-133-77.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e23c69ceee504628dafaec629ef59259bf252c82d1486a155a5da0ac26e7365e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www.confirmation-gov.co.uk-complete.form.jsp.transferet.co.in/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000;
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Thu, 09 Mar 2017 20:06:11 GMT
x-amz-request-id
BM2VQZMHAG52JY9J
ETag
"2bc32f35235768ced960bd0553d4fedb"
X-Frame-Options
SAMEORIGIN
Content-Type
application/javascript
Cache-Control
public, max-age=31009796
Date
Tue, 23 Mar 2021 01:25:38 GMT
Connection
keep-alive
X-Robots-Tag
noindex, nofollow
Vary
Accept-Encoding
Content-Length
3792
x-amz-id-2
pFeRXluO5O/ZJMbTRbfR13EWOJnuINPdsW+XgOc3ZjMY/jQcC0vqn2riyGD+tsDS22ub6GKmlKI=
gov.uk_logotype_crown.png
www.tax.service.gov.uk/template/assets/images/ 		780 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.tax.service.gov.uk/template/assets/images/gov.uk_logotype_crown.png
Requested by
Host: www.confirmation-gov.co.uk-complete.form.jsp.transferet.co.in
URL: https://www.confirmation-gov.co.uk-complete.form.jsp.transferet.co.in/form.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.79.133.77 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-79-133-77.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
14b98db97bbd6cb1f33935d3e0d973fa68ca0c38fb5762b033423ceffe9e16f6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.confirmation-gov.co.uk-complete.form.jsp.transferet.co.in/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000;
X-Content-Type-Options
nosniff
Last-Modified
Wed, 17 Mar 2021 11:09:55 GMT
x-amz-request-id
505TKK3KNYKGT9EQ
ETag
"7a0ea44ffc50dac67b82f0f70639d2ff"
X-Frame-Options
DENY
x-amz-id-2
FcFvFfaLYzDtkQ4poQCqWzcE/c/vnmSKmynZAOJYLNEJGbxdrTE4HzU7E6EZXiZJMoFOf2xnOkM=
Content-Type
image/png
Cache-Control
max-age=1881
Date
Tue, 23 Mar 2021 01:25:38 GMT
Connection
keep-alive
X-Robots-Tag
noindex, nofollow
Content-Length
780
X-XSS-Protection
1; mode=block
Expires
Tue, 23 Mar 2021 01:56:59 GMT
open-government-licence_2x.png
www.tax.service.gov.uk/template/assets/images/ 		504 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.tax.service.gov.uk/template/assets/images/open-government-licence_2x.png
Requested by
Host: www.confirmation-gov.co.uk-complete.form.jsp.transferet.co.in
URL: https://www.confirmation-gov.co.uk-complete.form.jsp.transferet.co.in/form.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.79.133.77 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-79-133-77.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
2dcbca9026a39b5e4cc536b2f842bd173148b018c7ce369a5930558f4de0e23b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.confirmation-gov.co.uk-complete.form.jsp.transferet.co.in/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000;
X-Content-Type-Options
nosniff
Last-Modified
Wed, 17 Mar 2021 11:09:55 GMT
x-amz-request-id
941HN23RW5CDZ2V2
ETag
"77b25839a24ed3ac7fab794efd278532"
X-Frame-Options
DENY
x-amz-id-2
BjJw0wgKRKZXZ8/tQO68SnwkCunp7MV8Rv//HQ/tiNn/88yMWZIfxScjFrLLyQ/LQdsKeVBxbOQ=
Content-Type
image/png
Cache-Control
max-age=1502
Date
Tue, 23 Mar 2021 01:25:38 GMT
Connection
keep-alive
X-Robots-Tag
noindex, nofollow
Content-Length
504
X-XSS-Protection
1; mode=block
Expires
Tue, 23 Mar 2021 01:50:40 GMT
application.min.js
www.tax.service.gov.uk/assets/2.214.0/javascripts/ 		288 KB
95 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.tax.service.gov.uk/assets/2.214.0/javascripts/application.min.js
Requested by
Host: www.confirmation-gov.co.uk-complete.form.jsp.transferet.co.in
URL: https://www.confirmation-gov.co.uk-complete.form.jsp.transferet.co.in/form.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.79.133.77 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-79-133-77.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
b1ba9b0ff9669b7ffd38f4c96d42441573db020edcd45d46f4468d76f1ccf40f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www.confirmation-gov.co.uk-complete.form.jsp.transferet.co.in/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000;
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Thu, 09 Mar 2017 20:06:11 GMT
x-amz-request-id
3BBBE60300D1516B
ETag
"99bb8a0bfe9e0aec878fda1670c56002"
X-Frame-Options
SAMEORIGIN
Content-Type
application/javascript
Cache-Control
public, max-age=30277059
Date
Tue, 23 Mar 2021 01:25:38 GMT
Connection
keep-alive
X-Robots-Tag
noindex, nofollow
Vary
Accept-Encoding
Content-Length
96369
x-amz-id-2
3dyrbTxpWd8CO1Tkq/XnJIlJIG9JPtMAwpNYb46Y5uJLh3PCyJHLeJ2XCY246FqwPyHyaL4N6co=
govuk-template-print.css
www.tax.service.gov.uk/template/assets/stylesheets/ 		1 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.tax.service.gov.uk/template/assets/stylesheets/govuk-template-print.css
Requested by
Host: www.confirmation-gov.co.uk-complete.form.jsp.transferet.co.in
URL: https://www.confirmation-gov.co.uk-complete.form.jsp.transferet.co.in/form.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.79.133.77 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-79-133-77.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
5bb990686d6668df3f9d5208b10fa83d2f5d55820b442be13542a3dfbd3e361a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.confirmation-gov.co.uk-complete.form.jsp.transferet.co.in/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000;
Content-Encoding
gzip
X-Content-Type-Options
nosniff
x-amz-request-id
VKNNAXXG2ZSK1ADY
Connection
keep-alive
Content-Length
675
x-amz-id-2
Alpwo85FVpr/eYCLw717mwgoJF7Of07o/i1JEoe/UOi/rNMgTDDk1BkikrsheV9e2VI3GYoZnxA=
Last-Modified
Wed, 17 Mar 2021 11:09:55 GMT
X-Frame-Options
DENY
Date
Tue, 23 Mar 2021 01:25:38 GMT
Vary
Accept-Encoding
Content-Type
text/css
X-XSS-Protection
1; mode=block
Cache-Control
max-age=1183
ETag
"6652f6207c256a26f0987cfd09c6be57"
X-Robots-Tag
noindex, nofollow
Expires
Tue, 23 Mar 2021 01:45:21 GMT
truncated
/ 		94 KB
94 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
048b93884a1b51d20f2a3140541d450cb6b82c6c2cf69128ea1d09fdd9699f30

Request headers

Origin
https://www.confirmation-gov.co.uk-complete.form.jsp.transferet.co.in
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
application/font-woff
hmrc_crest_18px.png
www.tax.service.gov.uk/assets/2.214.0/images/icons/crests/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.tax.service.gov.uk/assets/2.214.0/images/icons/crests/hmrc_crest_18px.png
Requested by
Host: www.tax.service.gov.uk
URL: https://www.tax.service.gov.uk/assets/2.214.0/stylesheets/application.min.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.79.133.77 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-79-133-77.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
c208f82493fb15f9261ba474cf6615ddc22e51984177095c4d12d2ad39647ca9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www.tax.service.gov.uk/assets/2.214.0/stylesheets/application.min.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000;
X-Content-Type-Options
nosniff
Last-Modified
Thu, 09 Mar 2017 20:05:44 GMT
x-amz-request-id
N25CFFC8WJ7PMFVD
ETag
"7dd6615768d476f34594fa593b3e6588"
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Cache-Control
public, max-age=31067157
Date
Tue, 23 Mar 2021 01:25:38 GMT
Connection
keep-alive
X-Robots-Tag
noindex, nofollow
Content-Length
1637
x-amz-id-2
8sba//HcjH5j30+lxN5tOeHfbLS4Ilqs6fBw7dk+AEK2wnkXVim5bA4nv1/kVxU3vSDe/gGRh4o=
truncated
/ 		71 KB
71 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
01c73d5dd84423dd2fc30aabd1de09a86b36b6de9e2e240d954c09cbb1d97aba

Request headers

Origin
https://www.confirmation-gov.co.uk-complete.form.jsp.transferet.co.in
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
application/font-woff
analytics.js
www.google-analytics.com/ 		46 KB
19 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.confirmation-gov.co.uk-complete.form.jsp.transferet.co.in
URL: https://www.confirmation-gov.co.uk-complete.form.jsp.transferet.co.in/form.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
0f3be44690ae9914ae3e47b7752e1bdea316f09938e9094f99e0de19ccd8987a
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.confirmation-gov.co.uk-complete.form.jsp.transferet.co.in/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 05 Feb 2021 21:33:27 GMT
server
Golfe2
age
7033
date
Mon, 22 Mar 2021 23:28:25 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
18980
expires
Tue, 23 Mar 2021 01:28:25 GMT
govuk-crest.png
www.tax.service.gov.uk/template/assets/stylesheets/images/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.tax.service.gov.uk/template/assets/stylesheets/images/govuk-crest.png
Requested by
Host: www.tax.service.gov.uk
URL: https://www.tax.service.gov.uk/template/assets/stylesheets/govuk-template.css
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.79.133.77 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-79-133-77.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
bb9e22aff7881b895c2ceb41d9340804451c474b883f09fe1b4026e76456f44b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.tax.service.gov.uk/template/assets/stylesheets/govuk-template.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000;
X-Content-Type-Options
nosniff
Last-Modified
Wed, 17 Mar 2021 11:09:55 GMT
x-amz-request-id
SGJGP27H5T2E62ND
ETag
"bcd5768bd7721641ee71ba103bb38900"
X-Frame-Options
DENY
x-amz-id-2
9/mkflTMvnmMG4zDv1uSgZZzgRN5S9Xdk5PwxTebHimYsk2NfSbjq6Eb7wcYPktlIUbX7UaRj4s=
Content-Type
image/png
Cache-Control
max-age=1514
Date
Tue, 23 Mar 2021 01:25:38 GMT
Connection
keep-alive
X-Robots-Tag
noindex, nofollow
Content-Length
3584
X-XSS-Protection
1; mode=block
Expires
Tue, 23 Mar 2021 01:50:52 GMT
collect
www.google-analytics.com/j/ 		2 B
98 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j88&a=99273066&t=event&_s=1&dl=https%3A%2F%2Fwww.confirmation-gov.co.uk-complete.form.jsp.transferet.co.in%2Fform.html&ul=en-us&de=UTF-8&dt=Enter%20your%20SA%20details%20-%20Government%20Gateway&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=sos_create_gg_account&ea=designatory_details_begin&el=begin&_u=IEBAAEABAAAAAC~&jid=1988631761&gjid=965049493&cid=546254679.1616462739&tid=UA-43414424-1&_gid=275744610.1616462739&_r=1&_slc=1&cd23=PERTAX&z=164101720
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
a048e640908046be06e00eab37742b5d5ff80964af58cfd22f7cb2de4dfe375f
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.confirmation-gov.co.uk-complete.form.jsp.transferet.co.in/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Tue, 23 Mar 2021 01:25:38 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.confirmation-gov.co.uk-complete.form.jsp.transferet.co.in
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/ 		35 B
63 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/collect?v=1&_v=j88&aip=1&a=99273066&t=pageview&_s=2&dl=https%3A%2F%2Fwww.confirmation-gov.co.uk-complete.form.jsp.transferet.co.in%2Fform.html&ul=en-us&de=UTF-8&dt=Enter%20your%20SA%20details%20-%20Government%20Gateway&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEABAAAAAC~&jid=&gjid=&cid=546254679.1616462739&tid=UA-43414424-1&_gid=275744610.1616462739&z=1907685184
Requested by
Host: www.confirmation-gov.co.uk-complete.form.jsp.transferet.co.in
URL: https://www.confirmation-gov.co.uk-complete.form.jsp.transferet.co.in/form.html
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.confirmation-gov.co.uk-complete.form.jsp.transferet.co.in/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 22 Mar 2021 18:25:21 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
25217
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: UK Government (Government)

27 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated object| html5 object| Modernizr string| reportProblemAjaxUrl string| GoogleAnalyticsObject function| ga string| ssoUrl function| $ function| jQuery object| jQuery1123011920949517336399 object| GOVUK object| _gaq object| JSON3 function| Mdtpdf function| onYouTubeIframeAPIReady object| google_tag_data object| gaplugins object| gaGlobal object| gaData

5 Cookies

Domain/Path Name / Value
.transferet.co.in/ Name: _gat
Value: 1
.transferet.co.in/ Name: _gid
Value: GA1.3.275744610.1616462739
.transferet.co.in/ Name: _ga
Value: GA1.3.546254679.1616462739
.confirmation-gov.co.uk-complete.form.jsp.transferet.co.in/ Name: mdtpdf
Value: eyJ2ZXJzaW9uIjoxLCJ1c2VyQWdlbnQiOiJNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvODkuMC40Mzg5LjcyIFNhZmFyaS81MzcuMzYiLCJsYW5ndWFnZSI6ImVuLVVTIiwiY29sb3JEZXB0aCI6MjQsInJlc29sdXRpb24iOiIxMjAweDE2MDAiLCJ0aW1lem9uZSI6LTYwLCJjbGllbnRTaWRlVGltZXN0YW1wIjoxNjE2NDYyNzM4NjU3LCJzZXNzaW9uU3RvcmFnZSI6dHJ1ZSwibG9jYWxTdG9yYWdlIjpmYWxzZSwiaW5kZXhlZERCIjp0cnVlLCJwbGF0Zm9ybSI6IkxpbnV4IHg4Nl82NCIsImRvTm90VHJhY2siOmZhbHNlLCJudW1iZXJPZlBsdWdpbnMiOjAsInBsdWdpbnMiOltdfQ==
www.confirmation-gov.co.uk-complete.form.jsp.transferet.co.in/ Name: seen_cookie_message
Value: yes